Re: html entities

Ok, I had tried that you said. I had the actual character stored in the DB. But when I display the character, it still has to go through the htmlspecialchar() function is PEAR's Quickform, turning the characters into other weird characters to the text elements' value. I tried displaying the character as normal text on the page and it works fine. Justin Patrin <papercrane@gmail.com> wrote: On Sat, 5 Mar 2005 11:00:03 -0800 (PST), fluidliqatyahoodotcom wrote: > I tried using the html_entity_decode with the third parameter. But PEAR's QuickForm still > displays "&" as "&" in the values of the text elements. It just happen > to the text elements. > What's wrong with this? As he said before, you need to update the script which is posting these values so that the char set is correct there. Then it should post the actual characters and not entities. > > Marek Kilimajer wrote: > fluidliqatyahoodotcom wrote: > > I never did anything to store it as HTML entities in the db. PEAR converted it itself and > > stored it into the db. > > on line 140 of common.php in the PHP PEAR, there is this line: > > $strAttr .= ' ' . $key . '="' . htmlspecialchars($value) . > > '"'; > > this line converts all the values to html entities with the htmlspecialchars(). > > This is ok, PEAR should do that. If it does not, your site would be > vulnerable to XSS atacks. > > > > > I tried things like html_entity_decode before storing into the db so that it will be saved > > as its characters but it didn't work. > > You should be able to use html_entity_decode(), but only with the third > parameter (charset). Look at > http://www.php.net/html_entity_decode if > your character set is supported. Else you will have to specify the > charset on the page so browser sends text in the right charset and not > in html entities. > -- Justin Patrin --------------------------------- Celebrate Yahoo!'s 10th Birthday! Yahoo! Netrospective: 100 Moments of the Web